[sssd PR#650][opened] Implement a hybrid mode of generating private groups
by jhrozek
URL: https://github.com/SSSD/sssd/pull/650
Author: jhrozek
Title: #650: Implement a hybrid mode of generating private groups
Action: opened
PR body:
"""
Related:
https://pagure.io/SSSD/sssd/issue/3822
Design page PR:
https://pagure.io/SSSD/docs/pull-request/72
Commit mesages follow, hopefully they are enough to explain what is going on.
SYSDB: Special case getgrnam and getgrgid searches in hybrid MPG mode
In hybrid MPG mode, we want to return the MPG group only in case the user
entry has no original GID set. To achieve this, we first search with the
non-MPG filter to find 'real' groups. If that fails, we try the MPG filter,
but throw away entries that has any real GID set.
Related: https://pagure.io/SSSD/sssd/issue/3822
SYSDB: Refactor the mpg and non-mpg searches out of sysdb_getgrnam() and sysdb_getgrgid() to make them more reusable
The getgrnam and getgrgid searches already special-case lookups with
overrides where in some cases the search falls back no a non-MPG search.
The upcoming special case for the hybrid mode would do something similar,
just in the opposite direction, so it makes sense to split out the
functions for just the MPG step and just the non-MPG step into reusable
functions.
Related: https://pagure.io/SSSD/sssd/issue/3822
CONFDB/NSS: Add the hybrid MPG mode
Permits a new option value 'hybrid' for the auto_private_groups option. The
option was even previously marked as a string option in both the configAPI
and the man pages, so we don't have to change the type now.
If the hybrid mode is selected and the user's original GID number is
available, then during initgroups and getpwnam, it is used as their primary
GID instead of the MPG group. The original group is also not added as a
secondary group during initgroups in this case.
Related: https://pagure.io/SSSD/sssd/issue/3822
CONFDB: Read auto_private_groups as string, not bool
In preparation to adding the third value of auto_private_groups, this patch
reads the confdb value as string and checks for the option values on its
own.
Related: https://pagure.io/SSSD/sssd/issue/3822
UTIL: Convert bool mpg to an enum mpg_mode
Instead of bool mpg inside struct sss_domain_info, let's introduce enum
mpg_mode that currently maps pretty much 1:1 to the boolean. In future
patches, a third value will be added.
Also adds a getter for the mpg_mode value because we want to discourage
getting or setting the value directly. Instead, the sss_domain_info
structure should be opaque in the future.
Related: https://pagure.io/SSSD/sssd/issue/3822
UTIL: Add a is_domain_mpg shorthand
Instead of looking into the domain structure directly, add a
sss_domain_is_mpg() function. This will make sense when we add a third
state instead of the boolean that will also be mpg-like.
Related: https://pagure.io/SSSD/sssd/issue/3822
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/650/head:pr650
git checkout pr650
5 years, 1 month
[sssd PR#718][opened] NSS: Avoid changing the memory cache ownership away from the sssd user (sssd-1-16 backport)
by jhrozek
URL: https://github.com/SSSD/sssd/pull/718
Author: jhrozek
Title: #718: NSS: Avoid changing the memory cache ownership away from the sssd user (sssd-1-16 backport)
Action: opened
PR body:
"""
Resolves:
https://pagure.io/SSSD/sssd/issue/3890
In case SSSD is compiled --with-sssd-user but run as root (which is the
default on RHEL and derivatives), then the memory cache will be owned by
the user that sssd_nss runs as, so root.
This conflicts with the packaging which specifies sssd.sssd as the owner. And
in turn, this means that users can't reliably assess the package integrity
using rpm -V.
This patch makes sure that the memory cache files are chowned to sssd.sssd
even if the nss responder runs as root.
Also, this patch changes the sssd_nss responder so that is becomes a member
of the supplementary sssd group. Even though in traditional UNIX sense,
a process running as root could write to a file owned by sssd:sssd, with
SELinux enforcing mode this becomes problematic as SELinux emits an error
such as:
type=AVC msg=audit(1543524888.125:1495): avc: denied { fsetid } for
pid=7706 comm="sssd_nss" capability=4 scontext=system_u:system_r:sssd_t:s0
tcontext=system_u:system_r:sssd_t:s0 tclass=capability
To make it possible for the sssd_nss process to write to the files, the
files are also made group-writable. The 'others' permission is still set
to read only.
Reviewed-by: Michal Židek <mzidek(a)redhat.com>
(cherry picked from commit 61e4ba58934b20a950255e05797aca25aadc1242)
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/718/head:pr718
git checkout pr718
5 years, 1 month
[sssd PR#721][opened] AD/IPA: Reset subdomain service name, not domain name
by jhrozek
URL: https://github.com/SSSD/sssd/pull/721
Author: jhrozek
Title: #721: AD/IPA: Reset subdomain service name, not domain name
Action: opened
PR body:
"""
Related: https://pagure.io/SSSD/sssd/issue/3911
Since commit 778f241e78241b0d6b8734148175f8dee804f494 the subdomain fail
over services use the "sd_" prefix. This was done to make it easier, until
the whole failover design works better with subdomains, to see which
services belong to the main domain from tools.
However, some parts of the code would still just use the domain name for
the failover service, which meant the service was not found, notably when
trying to reset services:
(Thu Dec 13 05:29:31 2018) [sssd[be[testrelm.test]]]
[ipa_srv_ad_acct_retried] (0x0400): Subdomain re-set, will retry lookup
(Thu Dec 13 05:29:31 2018) [sssd[be[testrelm.test]]] [be_fo_reset_svc]
(0x1000): Resetting all servers in service ipaad2016.test
(Thu Dec 13 05:29:31 2018) [sssd[be[testrelm.test]]] [be_fo_reset_svc]
(0x0080): Cannot retrieve service [ipaad2016.test]
This patch switches to reading the service names from the ad_options and
the sdap_service structures that are contained within ad_options.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/721/head:pr721
git checkout pr721
5 years, 2 months
[sssd PR#715][opened] Use 120 second default timeout for dbus (#1654537)
by AdamWill
URL: https://github.com/SSSD/sssd/pull/715
Author: AdamWill
Title: #715: Use 120 second default timeout for dbus (#1654537)
Action: opened
PR body:
"""
As discussed in #1654537, first login to a system as a FreeIPA
domain user now usually causes an expensive SELinux operation
to happen; this can take longer than the default dbus message
timeout of 25 seconds. To deal with this for now, let's use a
120 second default timeout; this is a big hammer, but unless we
can refactor things to use a longer timeout just for that one
call, or make the actual operation take less time, there's not
much else we can do.
Resolves:
https://bugzilla.redhat.com/show_bug.cgi?id=1654537
Signed-off-by: Adam Williamson <awilliam(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/715/head:pr715
git checkout pr715
5 years, 3 months
[sssd PR#717][opened] NSS: Avoid changing the memory cache ownership away from the sssd user (sssd-1-16 backport)
by jhrozek
URL: https://github.com/SSSD/sssd/pull/717
Author: jhrozek
Title: #717: NSS: Avoid changing the memory cache ownership away from the sssd user (sssd-1-16 backport)
Action: opened
PR body:
"""
Resolves: https://pagure.io/SSSD/sssd/issue/3890
In case SSSD is compiled --with-sssd-user but run as root (which is the
default on RHEL and derivatives), then the memory cache will be owned by
the user that sssd_nss runs as, so root.
This conflicts with the packaging which specifies sssd.sssd as the owner.
And in turn, this means that users can't reliably assess the package
integrity using rpm -V.
This patch makes sure that the memory cache files are chowned to sssd.sssd
even if the nss responder runs as root.
Also, this patch changes the sssd_nss responder so that is becomes a member
of the supplementary sssd group. Even though in traditional UNIX sense, a
process running as root could write to a file owned by sssd:sssd, with
SELinux enforcing mode this becomes problematic as SELinux emits an error
such as:
type=AVC msg=audit(1543524888.125:1495): avc: denied { fsetid } for
pid=7706 comm="sssd_nss" capability=4 scontext=system_u:system_r:sssd_t:s0
tcontext=system_u:system_r:sssd_t:s0 tclass=capability
To make it possible for the sssd_nss process to write to the files, the
files are also made group-writable. The 'others' permission is still set to
read only.
Reviewed-by: Michal Židek <mzidek(a)redhat.com>
(cherry picked from commit 61e4ba58934b20a950255e05797aca25aadc1242)
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/717/head:pr717
git checkout pr717
5 years, 4 months